Privacy Policy
Last updated: August 31, 2026.
This preview policy describes the data Rorix currently processes. It intentionally avoids promises for billing, certifications, residency, and self-service privacy controls that are not yet operational.
1. What we collect
Account data: identity and contact details returned by our authentication provider, plus organization membership and role information.
Project data: repository metadata, dependency manifests, SBOMs, policies, scan inputs, findings, and remediation history that you submit or authorize Rorix to process.
Operational data: request metadata, security events, feature settings, and diagnostic logs needed to operate and protect the service.
Rorix does not currently operate self-serve paid billing. We do not collect payment-card details through the product preview.
2. How we use it
Operate the service: authenticate users, run requested analysis, display results, and deliver configured notifications.
Protect the service: enforce authorization and limits, investigate abuse, and respond to security incidents.
Improve reliability: diagnose failures and measure aggregate service behavior. We do not use customer source code to train general-purpose models.
3. Service providers
Rorix uses service providers for hosting and workflows, authentication, transactional email, source-control integrations, and configured database or object storage. Current provider details are available from privacy@rorix.io.
Code Analysis is separately opt-in. Its disclosure identifies when selected source snippets are sent through Vercel AI Gateway to a configured zero-data-retention and no-training provider path.
We disclose information when required by valid legal process and will challenge requests we reasonably believe are overbroad where permitted.
4. Retention and deletion
Service data is retained while needed to provide the preview, satisfy configured evidence-retention settings, protect the platform, or meet legal obligations.
Project deletion removes project-scoped data through the product's deletion workflow. Some encrypted backups and security logs may remain until their normal rotation period ends.
Account-level export and deletion are currently handled by request at privacy@rorix.io. We confirm the applicable scope and completion timeline before processing.
5. Security
We use encrypted transport, scoped authorization, encrypted storage for supported secrets and source artifacts, and audit records around sensitive workflows.
No security program eliminates all risk. Report a suspected vulnerability to security@rorix.io rather than including secrets in ordinary support messages.
6. International processing
Processing locations depend on the configured hosting, authentication, email, source-control, database, and storage providers. We do not promise a specific residency region in the public preview.
Design partners that require a particular processing location must agree that scope in writing before supplying regulated data.
7. Your rights
Contact privacy@rorix.io to request access, correction, export, deletion, restriction, or objection. We may need to verify your identity and organization authority before acting.
Depending on where you live, you may have additional rights and the right to complain to a data-protection authority.
8. Children
Rorix is not intended for anyone under 16. If we learn that we hold personal data for a child under 16, contact us so we can investigate and delete it where required.